examples: add reaction lifecycle fixture - #5
Conversation
The workflow needs a deterministic security finding while its comment-reaction lifecycle is validated end to end. - add an explicit command-injection review fixture - keep the test isolated from workflow implementation files Generated with [Codex](https://github.com/openai)
|
@codex review |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| import { exec } from "node:child_process"; | ||
|
|
||
| export function showRevision(request, response) { | ||
| exec(`git show ${request.query.revision}`, (error, output) => { |
There was a problem hiding this comment.
P1 Avoid interpolating the request value into a shell command
request.query.revision is user-controlled and is interpolated into the shell command passed to exec, so a value such as HEAD; <command> executes arbitrary commands on the server. Validate it as a permitted revision format and invoke git without a shell (for example, execFile with argument array).
|
@codex review test reaction lifecycle |
1 similar comment
|
@codex review test reaction lifecycle |
|
@codex review focus on command injection |
|
@codex review cancellation test one |
|
@codex review cancellation test active |
|
@codex review cancel-me |
|
@codex review cancellation replacement |
|
@codex review cancellation status test |
|
@codex review final cancellation test |
|
@codex review replacement after cancellation |
|
@codex review verify inline publishing |
| import { exec } from "node:child_process"; | ||
|
|
||
| export function showRevision(request, response) { | ||
| exec(`git show ${request.query.revision}`, (error, output) => { |
There was a problem hiding this comment.
P1 Avoid interpolating the revision into a shell command
exec invokes a shell, so an attacker-controlled request.query.revision can append shell syntax (for example, ; curl ...) and execute arbitrary commands in the process context. Validate the revision against an expected Git object format and invoke Git with argument-based execution (such as execFile('git', ['show', revision], ...)) rather than shell interpolation.
|
Manual review, reaction lifecycle, cancellation state, discussion context, and inline publishing validated; closing the intentionally vulnerable smoke PR. |
1 participant
Deliberate command-injection fixture for validating manual review reactions and native inline findings.